fix: redact every column that names a user, verify unrecorded MySQL columns - #52

…olumns

`redact --user` in Postgres, MySQL and MongoDB erased rows by `user_id`
only. An invitation names a user as its inviter and as the user who
accepted it, so those rows, and the archived and quarantined events
carrying those payloads, kept the subject's id and email after the
command reported success. Every column and payload field that names a
user is matched now, as in the ClickHouse package.

MySQL recorded a column with no `_columns` record as current without a
look at the table, so after a schema applied by hand a changed path was
recorded as installed with the column still reading the old path. The
catalog's clause now goes onto a temporary table, and `SHOW CREATE
TABLE` renders that and the live table with the same server, so the two
compare as text: a match is recorded, anything else is drift.

…tion

Which columns hold a user id is a fact about the catalog, not about any
database, yet each destination carried its own list. A column can now
declare what it references (`user_id` references `users`), and the
engine answers `userReferenceColumns(stream)` for the mirror rows and
`userReferenceFields()` for the archived payloads; the four `redact`
implementations ask it instead of repeating the list.

The MySQL README's "no DDL after the first init" promise now says what
checking an unrecorded column does: a temporary table created and
dropped within the session, which is session state, not a schema change.

…om the streams

An extra column named `user_id` counted as naming a user before and
still does, without declaring anything. The payload paths `redact`
scrubs archived and quarantined events by come from the effective
streams, extra columns included, as path steps rather than top-level
field names, so a nested reference such as `metadata.owner_user_id`
is scrubbed too. Each destination builds its JSON path from the steps:
a parameterised array for Postgres, the JSON path helpers elsewhere.

…treams are selected

The archive keeps every event type the tail subscribed to, so a run
mirroring only `users` still archives `invitation.accepted` with the
subject's id in it. The payload paths `redact` scrubs by now come from
the whole catalog, with the selection adding only its extra columns.